cbor-x 1.6.5 → 1.6.6

package/dist/node.cjs

@@ -240,13 +240,22 @@ function checkedRead() {
 	}
 }
 
+function endOfCBORError() {
+	let error = new Error('Unexpected end of CBOR data');
+	error.incomplete = true;
+	return error
+}
+
 function read() {
+	// compared as < so that a NaN position (from a corrupt length) also throws instead of reading undefined
+	if (!(position$1 < srcEnd)) throw endOfCBORError()
 	let token = src[position$1++];
 	let majorType = token >> 5;
 	token = token & 0x1f;
 	if (token > 0x17) {
 		switch (token) {
 			case 0x18:
+				if (position$1 >= srcEnd) throw endOfCBORError()
 				token = src[position$1++];
 				break
 			case 0x19:
@@ -375,6 +384,9 @@ function read() {
 			return readFixedString(token)
 		case 4: // array
 			if (token >= maxArraySize) throw new Error(`Array length exceeds ${maxArraySize}`)
+			// every element occupies at least one byte, so a length beyond what remains in the source can
+			// never be satisfied; check before allocating so a tiny header can not force a huge allocation
+			if (token > srcEnd - position$1) throw endOfCBORError()
 			let array = new Array(token);
 		  //if (currentDecoder.keyMap) for (let i = 0; i < token; i++) array[i] = currentDecoder.decodeKey(read())	
 			//else 
@@ -382,6 +394,7 @@ function read() {
 			return array
 		case 5: // map
 			if (token >= maxMapSize) throw new Error(`Map size exceeds ${maxArraySize}`)
+			if (token > (srcEnd - position$1) / 2) throw endOfCBORError() // each entry needs at least two bytes
 			if (currentDecoder.mapsAsObjects) {
 				let object = {};
 				if (currentDecoder.keyMap) for (let i = 0; i < token; i++) object[safeKey(currentDecoder.decodeKey(read()))] = read();
@@ -473,11 +486,7 @@ function read() {
 					throw new Error('Unknown token ' + token)
 			}
 		default: // negative int
-			if (isNaN(token)) {
-				let error = new Error('Unexpected end of CBOR data');
-				error.incomplete = true;
-				throw error
-			}
+			if (isNaN(token)) throw endOfCBORError()
 			throw new Error('Unknown CBOR token ' + token)
 	}
 }
@@ -1141,10 +1150,12 @@ function readBundleExt() {
 }
 
 function readJustLength() {
+	if (!(position$1 < srcEnd)) throw endOfCBORError()
 	let token = src[position$1++] & 0x1f;
 	if (token > 0x17) {
 		switch (token) {
 			case 0x18:
+				if (position$1 >= srcEnd) throw endOfCBORError()
 				token = src[position$1++];
 				break
 			case 0x19: